Submit My Question - Recent Questions - Recent Answer
Msdn Tech >> Visual Studio Team System >> Team Foundation Server - Administration

Security behaving strange when adding users to project groups

Hi.
Hope someone can answer why our TFS server behaving as it does.

We are using TFS RTM 1.0 Trial, while waiting for the cds to be distributed

If the user is not member of any TFS group, the user has no access to the TFS server at all. - Great this works as it should.

If the user is a member of one of the projects, the user has access to all projects. This is both source safe and lots of other stuff.

To get more background I will try to explain the behaviour. I have made 5 projects call them A,B,C,D,E

First I add the user to [project B]\readers. Then I look through the rest of the projects using this user to see how many dinied signs I find. Access is denied on project B.Documents, B.Reports, C.Documents, E.Documents

next remove permission and add the user to [project B]\readers instead . Then I look through the rest of the projects using this user to see how many dinied signs I find. Access is denied on project C.Documents, E.Documents

next remove permission and add the user to [project C]\readers instead. Then I look through the rest of the projects using this user to see how many dinied signs I find. Access is denied on project B.Documents, E.Documents

next remove permission and add the user to [project D]\readers instead. Then I look through the rest of the projects using this user to see how many dinied signs I find. Access is denied on project A.Documents, B.Documents, C.Documents and E.documents

next remove permission and add the user to [project E]\readers instead. Then I look through the rest of the projects using this user to see how many dinied signs I find. Access is denied on project A.Documents, B.Documents, C.Documents

How I think it should work. If the user are reader on one project the user should not be able to access other projects or if he can see all projects he must not be able to see workitems, documents, reports, VSS stuff and so on.

Can anyone tell me why the TFS server is behaving as it does?

Please help.

Best regards,
Jens

[2091 byte] By [Jensk] at [2008-2-14]
«« Taking photos, Windows mobile 2005, without CameraCaptureDialog dialog?
»» Property & Component
# 1

The root of the issue you are seeing is tied to permissions for the global Team Foundation Valid Users group. By default, whenever a new project is created, the global Team Foundation Valid Users group is granted "view project level information" (or GENERIC_READ) rights on the security object representing that project. If you would like to maintain complete separation of the projects, you need to revoke that right:

1) Launch Visual Studio and open the Team Explorer
2) Right click on the project node
3) Select Team Project Settings::Security
4) Select [SERVER]\Team Foundation Valid Users
5) Clear the Allow checkbox for “view project level information”

When a user is added to any TFS group, or is discovered when synchronizing group contents with AD, that user automatically becomes part of the Team Foundation Valid Users group. This is a logical group that represents all users known to the system.

The pattern you are seeing can be complicated by things like AD synchronization and caching. It is a little hard to interpret without knowing more about how you were doing the experiments. In general, TFS synchronizes with AD once per hour and that is when changes made to AD groups will normally show up. The exception is when the membership of a TFS group containing an AD group changes... in that case, that group is synchronized when the changes are made.

BillEssaryMSFT at 2007-9-9 > top of Msdn Tech,Visual Studio Team System,Team Foundation Server - Administration...
Visual Studio Team System
Team Foundation Server - Administration

Visual Studio Team System Hot Topic

Visual Studio Team System New Topic

Visual Studio Team System

Java / MSDN / Linux Tech / PHP Tech / MSDN DotNet / MSDN TECH / Health Library / Programmers Tech / visual basic Tech / Developer Tech / Ipod faqs / Msdn China Tech

Site Classified